Has the Digital Duty of Care Bill passed?

Timeline

1. October 2024The statutory review of the Online Safety Act recommends a duty of care
2. November 2024The Government announces it will legislate a digital duty of care
3. 8 September 2026Exposure draft of the Bill released for consultation
4. 15 October 2026Bill introduced into the House of Representatives and referred to a Senate committee
5. 28 October 2026Bill passes the House of Representatives with amendments
6. 9 and 10 November 2026Senate committee public hearings in Canberra
7. 20 November 2026Senate committee report due Next
8. Not yet knownSenate vote
9. Not yet knownRoyal Assent. The Bill becomes law
10. Day after Royal AssentSome changes start, including a 24-hour deadline for eSafety removal notices
11. 12 months after Royal AssentThe duty starts. Current industry codes and standards are repealed

What stage is the Bill at?

Not yet. As at 14 November 2026 it has passed the House of Representatives only. It still has to pass the Senate and receive Royal Assent before it becomes law.

Will it pass the Senate?

That is not certain. The Government needs support from outside its own ranks in the Senate. The Coalition has said it opposes the Bill. The Greens have said they want changes, including a right for people to sue. The Bill could pass as it is, pass with amendments, or stall.

Is there an exemption for small business websites?

Not yet. The Bill would let the Minister exempt a service, or a class of services, that poses little risk to users in Australia (section 25B). No exemption can be made until the Bill is law, and none has been announced.

An exemption could cover the whole duty or only part of it. The Bill's own example is an exemption from the risk assessment requirement. It could also come with conditions. The explanatory memorandum says the power is there so the law can focus on services that pose a real risk.

The Council of Small Business Organisations Australia has said the Department told it an exemption for low-risk websites was being considered. Small business groups asked for an explicit exemption at the Senate hearings.

Until an exemption exists, the safe assumption is that a business website is covered. Read the full picture on the small business exemption.

What happened at the Senate hearings?

The committee held public hearings in Canberra on 9 and 10 November 2026. COSBOA appeared on the first day. The eSafety Commissioner and the Department appeared on the second. The committee also received more than 100 written submissions.

For small business, three things came out of the second day:

• The eSafety Commissioner said eSafety is not focused on small businesses that have a web presence. Its focus is high-risk, high-harm services.
• eSafety said it would publish criteria for the lowest-risk services. The early criteria were no user interaction, no user messaging, no interaction between adults and children, and no AI chatbot.
• The Department said most websites would be low risk, and described their risk assessment as a short checkbox process.

None of this changes the wording of the Bill. What eSafety and the Department said about small business.

What applies during the 12 months before the duty starts?

eSafety's existing industry codes and standards stay in force for the 12 months after Royal Assent, and eSafety has said it will keep enforcing them. In that period eSafety plans to consult on and publish guidance and the risk assessment requirements.

What changed between the draft and the Bill?

• The test changed. The draft asked services to ensure safety "so far as is reasonably practicable". The Bill asks for "appropriate action" and "effective measures".
• Cost is excluded. This means the cost to the business of putting a safety measure in place. Section 26A lists what decides whether an action is appropriate, such as how likely and how serious the harm is, and then says the cost of the action must not be taken into account. A business could not argue that a measure was too expensive. It could still argue that a measure is out of proportion to the risk.
• New harms need Parliament. The Bill lists the kinds of material it treats as seriously harmful or harmful to children (sections 25D and 25E). Under the draft, the Minister could have added new kinds to those lists by regulation, without a vote. In the Bill, adding one needs Parliament to pass an amendment. For a business, that means the list of harms to consider cannot grow quietly. What harms the Bill is about.
• Some material is excluded, including professional news.
• AI services are covered more widely. The Bill covers services that generate material using artificial intelligence, whether or not that material is shared.

For a short account of each development as it happens, see our updates.

What happens next?

The Senate committee reports on 20 November 2026. The Senate then debates the Bill and may amend it. We update this page on the day of each step.

Last updated 14 November 2026